- Arch-security - lists.archlinux.org

[arch-security] [ASA-201705-18] libplist: multiple issues
by Santiago Torres-Arias 17 May '17

17 May '17

Arch Linux Security Advisory ASA-201705-18 ========================================== Severity: High Date : 2017-05-16 CVE-ID : CVE-2017-5209 CVE-2017-5545 CVE-2017-5834 CVE-2017-5835 CVE-2017-5836 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437 CVE-2017-6438 CVE-2017-6439 CVE-2017-6440 Package : libplist Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-215 Summary ======= The package libplist before version 2.0.0-1 is vulnerable to multiple issues including arbitrary command execution, denial of service and information disclosure. Resolution ========== Upgrade to 2.0.0-1. # pacman -Syu "libplist>=2.0.0-1" The problems have been fixed upstream in version 2.0.0. Workaround ========== None. Description =========== - CVE-2017-5209 (information disclosure) The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. - CVE-2017-5545 (denial of service) The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. - CVE-2017-5834 (denial of service) The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file. - CVE-2017-5835 (denial of service) libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. - CVE-2017-5836 (denial of service) The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free. - CVE-2017-6435 (denial of service) The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file. - CVE-2017-6436 (denial of service) The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file. - CVE-2017-6437 (denial of service) The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file. - CVE-2017-6438 (arbitrary command execution) Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file. - CVE-2017-6439 (denial of service) Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file. - CVE-2017-6440 (denial of service) The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file. Impact ====== An attacker is able to crash the process, read sensitive information or execute arbitrary code on the host by providing a crafted plist file or string. References ========== https://github.com/libimobiledevice/libplist/issues/93 https://github.com/libimobiledevice/libplist/issues/94 https://github.com/libimobiledevice/libplist/issues/95 https://github.com/libimobiledevice/libplist/issues/99 https://github.com/libimobiledevice/libplist/issues/98 https://github.com/libimobiledevice/libplist/issues/100 https://github.com/libimobiledevice/libplist/blob/master/NEWS https://bugzilla.redhat.com/show_bug.cgi?id=1412613 https://bugzilla.redhat.com/show_bug.cgi?id=1416002 https://bugzilla.redhat.com/show_bug.cgi?id=1418591 https://bugzilla.redhat.com/show_bug.cgi?id=1418592 https://bugzilla.redhat.com/show_bug.cgi?id=1418593 https://security.archlinux.org/CVE-2017-5209 https://security.archlinux.org/CVE-2017-5545 https://security.archlinux.org/CVE-2017-5834 https://security.archlinux.org/CVE-2017-5835 https://security.archlinux.org/CVE-2017-5836 https://security.archlinux.org/CVE-2017-6435 https://security.archlinux.org/CVE-2017-6436 https://security.archlinux.org/CVE-2017-6437 https://security.archlinux.org/CVE-2017-6438 https://security.archlinux.org/CVE-2017-6439 https://security.archlinux.org/CVE-2017-6440

1 0

[arch-security] [ASA-201705-17] lxc: insufficient validation
by Christian Rebischke 13 May '17

13 May '17

Arch Linux Security Advisory ASA-201705-17 ========================================== Severity: Low Date : 2017-05-13 CVE-ID : CVE-2017-5985 Package : lxc Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-204 Summary ======= The package lxc before version 1:2.0.8-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1:2.0.8-1. # pacman -Syu "lxc>=1:2.0.8-1" The problem has been fixed upstream in version 2.0.8. Workaround ========== None. Description =========== This security issue was reported by Jann Horn and has to do with a lack of netns ownership check in lxc-user-nic, which would allow any user with a lxc-usernet allocation to create network interfaces on the host including choosing the name of that network interface. The created interface wouldn't be UP so is unlikely to be automatically brought up or get an address, but this issue could be used to squat the name of a real system network interface before it appears. Impact ====== A local attacker is able to spoof a new network interface. References ========== https://lists.linuxcontainers.org/pipermail/lxc-users/2017-March/012925.html https://security.archlinux.org/CVE-2017-5985

1 0

[arch-security] [ASA-201705-16] openvpn: denial of service
by Remi Gacogne 13 May '17

13 May '17

Arch Linux Security Advisory ASA-201705-16 ========================================== Severity: High Date : 2017-05-13 CVE-ID : CVE-2017-7478 CVE-2017-7479 Package : openvpn Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-271 Summary ======= The package openvpn before version 2.4.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "openvpn>=2.4.2-1" The problems have been fixed upstream in version 2.4.2. Workaround ========== The most severe vulnerability, CVE-2017-7478, which allows a remote unauthenticated attacker to cause a denial of service, can be mitigated by setting up tls-auth or tls-crypt. Note that this requires changing both server and clients configurations. Description =========== - CVE-2017-7478 (denial of service) A security issue has been found in OpenVPN <= 2.4.1 where an unauthenticated attacker can send a packet with an unexpected payload size during SSL handshake, causing a server shutdown. Servers using tls-auth are protected against this attack as packets with an invalid HMAC are discarded before being processed by the vulnerable code. - CVE-2017-7479 (denial of service) A security issue has been found in OpenVPN <= 2.4.1 where an authenticated attacker can crash a server using an AEAD mode cipher by sending crafted data to exhaust the packet counter. Impact ====== A remote, unauthenticated attacker can crash a server not using tls- auth or tls-crypt by sending a packet with an unexpected payload size. A remote, authenticated attacker can crash a server using an AEAD mode cipher by sending crafted data to exhaust the packet counter. References ========== https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineer… https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quarkslab-results/ http://blog.quarkslab.com/security-assessment-of-openvpn.html https://security.archlinux.org/CVE-2017-7478 https://security.archlinux.org/CVE-2017-7479

1 0

[arch-security] [ASA-201705-15] zziplib: multiple issues
by Santiago Torres-Arias 12 May '17

12 May '17

Arch Linux Security Advisory ASA-201705-15 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5979 CVE-2017-5981 Package : zziplib Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-191 Summary ======= The package zziplib before version 0.13.66-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.13.66-2. # pacman -Syu "zziplib>=0.13.66-2" The problems have been fixed upstream in version 0.13.66. Workaround ========== None. Description =========== - CVE-2017-5974 (arbitrary code execution) Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5975 (arbitrary code execution) Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5976 (arbitrary code execution) Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5979 (denial of service) The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file. - CVE-2017-5981 (denial of service) seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. Impact ====== A remote attacker is able to crash the target process or execute arbitrary code on the host by providing a malicious file. References ========== https://bugs.archlinux.org/task/53133 http://www.openwall.com/lists/oss-security/2017/02/14/3 https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-… https://github.com/gdraheim/zziplib/commit/03de3beabbf570474a9ac05d6dc6b42c… https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-… https://github.com/gdraheim/zziplib/commit/64e745f8a3604ba1c444febed86b5e14… https://github.com/gdraheim/zziplib/commit/33d6e9c52fcf1a8983896a512033994d… https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-… https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in… https://blogs.gentoo.org/ago/2017/02/09/zziplib-assertion-failure-in-seeko-… https://github.com/gdraheim/zziplib/commit/3810583f4dee1bac8f02ab41e01bbffd… https://github.com/gdraheim/zziplib/commit/0ce576bdcb330c40cc39636c6232ced0… https://security.archlinux.org/CVE-2017-5974 https://security.archlinux.org/CVE-2017-5975 https://security.archlinux.org/CVE-2017-5976 https://security.archlinux.org/CVE-2017-5979 https://security.archlinux.org/CVE-2017-5981

1 0

[arch-security] [ASA-201705-14] git: access restriction bypass
by Remi Gacogne 12 May '17

12 May '17

Arch Linux Security Advisory ASA-201705-14 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-8386 Package : git Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-267 Summary ======= The package git before version 2.13.0-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 2.13.0-1. # pacman -Syu "git>=2.13.0-1" The problem has been fixed upstream in version 2.13.0. Workaround ========== None. Description =========== A security issue has been found in git < 2.12.3, allowing a remote restricted user to execute an interactive pager on the server by causing it to spawn "git upload-pack --help". This is only an issue for servers running the "git-shell" restricted login shell. Impact ====== A remote attacker can use the interactive pager commands to access and modify arbitrary files on the affected host. If the login shell used is not git-shell, a remote attacker might also be able to run arbitrary commands on the affected host. References ========== http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html https://git.kernel.org/pub/scm/git/git.git/commit/?id=3ec804490a265f4c418a3… https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-83… https://security.archlinux.org/CVE-2017-8386

1 0

[arch-security] [ASA-201705-13] kdelibs: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-13 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kdelibs Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-270 Summary ======= The package kdelibs before version 4.14.32-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.14.32-1. # pacman -Syu "kdelibs>=4.14.32-1" The problem has been fixed upstream in version 4.14.32. Workaround ========== None. Description =========== KAuth <= 5.33.0 contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account. Impact ====== A local, unprivileged attacker can escalate privileges to become root on the affected host. References ========== https://commits.kde.org/kdelibs/264e97625abe2e0334f97de17f6ffb52582888ab https://www.kde.org/info/security/advisory-20170510-1.txt http://seclists.org/oss-sec/2017/q2/240 https://commits.kde.org/kauth/df875f725293af53399f5146362eb158b4f9216a https://security.archlinux.org/CVE-2017-8422

1 0

[arch-security] [ASA-201705-12] kauth: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-12 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kauth Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-269 Summary ======= The package kauth before version 5.33.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.33.0-2. # pacman -Syu "kauth>=5.33.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== KAuth <= 5.33.0 contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account. Impact ====== A local, unprivileged attacker can escalate privileges to become root on the affected host. References ========== https://cgit.kde.org/kauth.git/commit/?id=df875f725293af53399f5146362eb158b… https://www.kde.org/info/security/advisory-20170510-1.txt http://seclists.org/oss-sec/2017/q2/240 https://commits.kde.org/kauth/df875f725293af53399f5146362eb158b4f9216a https://commits.kde.org/kdelibs/264e97625abe2e0334f97de17f6ffb52582888ab https://security.archlinux.org/CVE-2017-8422

1 0

[arch-security] [ASA-201705-11] smb4k: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-11 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8849 Package : smb4k Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-268 Summary ======= The package smb4k before version 2.0.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.0.0-2. # pacman -Syu "smb4k>=2.0.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Smb4k <= 2.0.0 contains a logic flaw in which mount helper binary does not properly verify the mount command it is being asked to run. This allows calling any other binary as root since the mount helper is typically installed as suid. Impact ====== A local, unprivileged attacker can escalate privileges to become root on the affected host. References ========== https://www.kde.org/info/security/advisory-20170510-2.txt http://seclists.org/oss-sec/2017/q2/240 https://commits.kde.org/smb4k/a90289b0962663bc1d247bbbd31b9e65b2ca000e https://security.archlinux.org/CVE-2017-8849

1 0

[arch-security] [ASA-201705-10] lib32-freetype2: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-10 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8105 CVE-2017-8287 Package : lib32-freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-258 Summary ======= The package lib32-freetype2 before version 2.7.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.1-2. # pacman -Syu "lib32-freetype2>=2.7.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-8105 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c. - CVE-2017-8287 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted font. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935 https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48… https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc0… https://security.archlinux.org/CVE-2017-8105 https://security.archlinux.org/CVE-2017-8287

1 0

[arch-security] [ASA-201705-9] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-9 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-266 Summary ======= The package lib32-flashplugin before version 25.0.0.171-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 25.0.0.171-1. # pacman -Syu "lib32-flashplugin>=25.0.0.171-1" The problems have been fixed upstream in version 25.0.0.171. Workaround ========== None. Description =========== - CVE-2017-3068 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Advanced Video Coding engine of Adobe Flash Player < 25.0.0.171. - CVE-2017-3069 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BlendMode class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3070 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the ConvolutionFilter class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3071 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player < 25.0.0.171, when masking display object. - CVE-2017-3072 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BitmapData class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3073 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 25.0.0.171, when handling multiple mask properties of display objects. - CVE-2017-3074 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Graphics class of Adobe Flash Player < 25.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-15.html https://security.archlinux.org/CVE-2017-3068 https://security.archlinux.org/CVE-2017-3069 https://security.archlinux.org/CVE-2017-3070 https://security.archlinux.org/CVE-2017-3071 https://security.archlinux.org/CVE-2017-3072 https://security.archlinux.org/CVE-2017-3073 https://security.archlinux.org/CVE-2017-3074

1 0